Repository navigation
Release v0.10.0: Standalone Node.js & Docker Runtime, Model Sampling Profiles, and MDX Dos - #145
Conversation
- Add `OnboardingCard` to UI package and bump version to 0.9.6 - Refactor `TickMeter` chart primitive to use CSS Grid - Integrate `SidebarOnboarding` into `DashboardSidebar`
fix: update landing page for issue 110
Remove /login route in favour of / landing page
…support Add onboarding card & redesign landing page
- build: optimize Vite chunking for heavy dependencies (react, recharts, motion) and inject __APP_VERSION__ - perf: add public/_headers for aggressive static asset caching and enforce no-cache on HTML routes - ui: prevent iOS auto-zoom by increasing mobile input font size to 16px (text-base) - ui: remove touch-none on sliders to fix mobile scrolling interactions - ui: various layout and hook refinements across dashboard pages and components - auth: redirect unauthorized HTML requests to / instead of /login - worker: add /account* routing rule in wrangler.jsonc - chore: bump @codraoss/api to 0.9.7 and @codraoss/ui to 0.9.10 - feat: add SVG favicon
Signed-off-by: Devarshi Shimpi <devarshishimpi@gmail.com>
- Add `apps/node` to run the Codra backend as a standalone Node.js service using `@hono/node-server`. Includes environment bindings, dependency injection (`api-deps.ts`), and build configuration. - Extract shared API dependency injection (`createSharedApiDeps`) into `@codraoss/api`. - Move platform-specific logic (KV, OAuth, config, updates-email) out of `apps/worker` and into `packages/api/src/platform`. - Relocate `formatter.ts` from `apps/worker/src/services` into `packages/core/src`. - Move `updates-email-prompt.tsx` to `shared` components in the dashboard and refresh its styling. - Update tests, lockfiles, and `tsconfig.json` to reflect the new package structure and imports.
fix: align jobs and repos empty states
- core: Fix mojibake characters in formatter and tests, restoring actual emojis (✅, 👍, ℹ️, ⚪) - dashboard: Hide `JobsTable` when there are no jobs to prevent overlap with empty state - dashboard: Improve `ReposPage` layout with proper flexbox constraints and use `EmptyState` for empty search results
…r handling for token retrieval
…ports Feat: Extract Node.js backend, refine dashboard UX, and optimize performance
…port Integrate BullMQ, add Docker support, and extract node adapters
…eview prompt, and bump to v0.10.1
Feat: Docker runtime hardening and AI model sampling profiles
Docs: comprehensive deployment guides for Docker, Node.js and Railway
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![codra-app-personal[bot]](https://avatars.githubusercontent.com/in/3347243?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…back payload guard
There was a problem hiding this comment.
Codra Review
Here are some automated review suggestions for this pull request.
Note
6 files could not be reviewed, so this pass is incomplete.
Reviewed commit: 7ce5816a64
ℹ️ About Codra in GitHub
Your team has set up Codra to review pull requests in this repo. Reviews are triggered when you:
- Open a pull request for review
- Mark a draft as ready
If Codra has suggestions, it will comment; otherwise it will react with 👍.
|
|
||
| # Keep only the Node server's production dependency graph in the runtime image. | ||
| RUN rm -f apps/worker/package.json packages/ui/package.json \ | ||
| && npm pkg delete dependencies \ |
There was a problem hiding this comment.
Running npm pkg delete dependencies deletes the dependencies object from the root package.json. Subsequent execution of npm install --omit=dev will install no production dependencies, resulting in a runtime MODULE_NOT_FOUND crash for packages like @hono/node-server, bullmq, and ioredis.
| && npm pkg delete dependencies \ | |
| Remove `npm pkg delete dependencies` or use workspace pruning correctly. |
| else resolve(); | ||
| }); | ||
|
|
||
| const child = exec( |
There was a problem hiding this comment.
The setSecret function uses exec with a template literal that directly interpolates secretName into a shell command. If secretName contains shell metacharacters (e.g., ;, &, |), an attacker could execute arbitrary commands on the system. While secretName might be controlled internally, it is unsafe to use exec with unvalidated user-provided strings.
| const child = exec( | |
| Use `spawn` instead of `exec`, passing `secretName` as a separate argument to the command array to avoid shell interpretation. |
| expect(json.message).toBe('queued'); | ||
| const json = (await response.json()) as any; | ||
| expect(response.status).toBe(202); | ||
| expect(json.message).toBe("queued"); |
There was a problem hiding this comment.
The test case 'ignores webhooks for draft PRs' asserts that the response message is 'queued' and that the queue length is 1, which contradicts the test description. If the system is intended to ignore draft PRs, it should return a different status or not queue the job. The test as written confirms that the system incorrectly processes draft PRs, but the test expectations are set up to expect this incorrect behavior, masking a functional bug in the webhook handler.
| accountName: parsed.data.name, | ||
| timezone: parsed.data.timezone, | ||
| }); | ||
| const account = await accounts.updateAccountSettings( |
There was a problem hiding this comment.
The accountUpdateSchema allows name or timezone to be optional, but the updateAccountSettings call passes both fields as parsed.data.name and parsed.data.timezone directly. If a user only provides a name in the request, parsed.data.timezone will be undefined. Passing undefined to updateAccountSettings likely causes the database column to be overwritten with NULL or result in an API error, effectively clearing the user's previously set timezone when they only intended to change their name.
| path: '/login', | ||
| element: withSuspense(LoginPage, true), | ||
| path: "/", | ||
| element: <LandingPage />, |
There was a problem hiding this comment.
The LandingPage component is loaded via React.lazy (defined on line 9 in the old code, but now implicitly lazy/imported) and is rendered directly without the withSuspense wrapper that is required for lazy-loaded components in this architecture. This will cause a runtime error when React attempts to render the lazy component without a Suspense boundary.
Summary
This release merges the
devbranch intomainfor the v0.10.0 milestone. It introduces standalone Node.js and Docker deployment support powered by Redis and BullMQ, hardens the production container runtime on Node 24 distroless, introduces AI model sampling calibration and precision gating, re-architects batch review prompts with strict file-scoping, and completely migrates the documentation to MDX.Standalone Node.js Server & Multi-Platform Hosting (
apps/node&@codraoss/node-adapters)@hono/node-serverwith modular adapters for Redis KV, BullMQ review job queues, and Redis session stores.START_APIandSTART_WORKERflags.Hardened Production Docker Runtime
node:24-trixie-slim(builder) andgcr.io/distroless/nodejs24-debian13:nonroot(runner) across multi-arch targets ($TARGETARCH).docker-compose.ymlfor turnkey self-hosting with Redis and PostgreSQL.AI Model Sampling Profiles & Precision Calibration (
packages/models&packages/core)model-profiles.json) calibrating sampling parameters (temperature, topP, thinking budgets) across providers (Google Gemini 3.5/3.6/3.7/3.8, Gemma 4, GLM-4, NVIDIA Nemotron-3/3.5, Step-5).apply-profile.ts,profile-sampling.ts).google-retry.ts).Review Quality, Evidence Grounding & Batch Review Prompts
json-extract.ts,jsonrepair) to salvage truncated or malformed LLM responses.Cloudflare Worker CPU Protection
MAX_ATTEMPTS_PER_WORKFLOW_INSTANCEto cap review attempts per workflow instance, cleanly re-enqueuing fresh instances for large PRs to prevent Cloudflare Worker CPU timeout exhaustion.Documentation Migration to MDX (
docs/).github/workflows/trigger-docs-deploy.yml) and SEO generation (docs-seo.ts).Dashboard UX & Performance Overhaul (
apps/dashboard)job-logs.tsxwith dedicatedfile-row.tsxcomponents and state reducer inrepos.tsx.Migration & Deployment Notes
gcr.io/distroless/nodejs24-debian13:nonroot. Healthcheck command uses/nodejs/bin/nodeinstead of shell wrapper.@codraoss/node-server, ensureREDIS_URLandDATABASE_URLare provided. Workers and API server can be toggled usingSTART_WORKER=true|falseandSTART_API=true|false.LLM_CONFIG_ENCRYPTION_KEY,APP_URL,AUTH_CALLBACK_URL, and GitHub App credentials when provisioning new Node.js instances.Verification & Testing
npm run build:packages).